Limit usernames to alphanumeric characters

Well, Drupal.org is just doing straight up what core does. I don't think we'd want to deviate from that.

Drupal.org isn't only doing straight up what core does, there's already justification for using contrib and custom modules on Drupal.org, I think we should consider the benefits a change like this would have before dismissing it based on Drupal core behaviour.

Specifically this issue is in relation to #448074: @ style mentions for usernames which send notifications for D.o, where we to make this change we could implement nice looking, relatively standardized @mentions within issue comments to notify users that they have been mentioned in a specific issue, which makes it easier to bring issues and responses to the attention of those who need to be alerted. I for one have oft found my name mentioned in issues much to late when doing an ego search, this would be an improvement.

Can we get someone to look at the database to determine exactly how many or what percentage of users would be negatively affected by a change like this?

I agree there that there is a lot of potential upside for this, and it wouldn't necessarily require everyone to change their usernames from a login perspective, it seems to me like it would be quite acceptable to replace spaces with underscores and allow people to login using spaces in this username (though I guess checks would need to be made to ensure there weren't usernames existing that conflict with this).

As someone who is already using @ style mentions a lot I do think it warrants more thought.

Yes, I'm aware what it's for. I'm questioning whether we want to deviate from core's default behaviour *and* incur the work of a data migration *and* cause numerous support requests from people with newly screwed up logins, etc. I have a feeling if the parent issue was deployed, people would naturally fix their names without any prodding and without all the overhead implied by this issue.

At any rate:

SELECT u.name FROM users u WHERE u.name LIKE '% %';

85,448 records. Including some super fun ones like "- Martin -" and ".watch.Teenage Mutant Ninja Turtles.2014.Movie.Online" ;)

Presumably "@" would screw it up too:

SELECT u.name FROM users u WHERE u.name LIKE '%@%';

22,950 records. A few old pre-Drupal.org log ins (back then they were like killes@drop.org).

If there are other special characters, I can do more queries. But suffice to say, this is going to be non-trivial to do.

I don't believe there will be any issue with the username containing the '@' symbol, as IIRC the regex just checks for words beginning with the prefix, and matches all the way to the suffix (if defined) or the end of the word (if no suffix defined).

85,448 is definitely not a trivial number, but what percentage is that to total users, and even more so, what percentage of those are certified and/or active?

I don't doubt that it would have to be done right. Ideally I think the approach would be to require the effected users to change their username upon logging in to the site, or give them a onetime link that will automatically make the change to a prechosen replacement if they prefer not to change it themselves.

Right. So why don't we just not do anything, and let peer pressure do the hard work when people either can't refer to a given user, or can't receive notifications because of their email? :) Users have permissions to change their own usernames; they can solve this themselves.

To answer your question:

SELECT u.name FROM users u WHERE u.name LIKE '% %' AND status = 1;

That brings it down to 77,204

SELECT u.name FROM users u
INNER JOIN users_roles ur ON u.uid = ur.uid AND ur.rid = 36 # confirmed
WHERE u.name LIKE '% %' AND u.status = 1;

That brings it down to 3949, and they're mostly all people you've heard of (moshe weitzman, matt westgate, Jose Reyero, etc.)

If we dont want to *force* people to change their usernames via a migration,
maybe we can use the queries to notify people of the new features and the reason(s) they might want to change their name, but let them know they dont have to.

I'm not sure if "display name" will help us, since I would guess people would try and @display name, and not look up the username to reference.

I would really like to see #448074: @ style mentions for usernames which send notifications for D.o but I dont think this is a blocker to it.

As far as the peer pressure aspect, I absolutely think receipt of mentions should be as optional as having a contact form on your profile.

Thanks for the research, I think those numbers are acceptable, but I also agree we don't want to make this difficult for users.

I feel we need to be careful here.

Are we only concerned with spaces? What about international characters and accents and stuff?

I'm concerned about the implications for diversity and inclusion by limiting people's identities like this.